CVE-2026-1814: Rapid7 Nexpose Insecure Java Keystore Password Generation

Severity: medium (CVSS 6.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-03 · updated 2026-06-17
Weakness: CWE-331

Description

Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.

Affected products

Rapid7 InsightVM/Nexpose: from 6.4.50 before 8.36.0 — fixed in 8.36.0

How to fix

Upgrade to a fixed version: Rapid7 InsightVM/Nexpose 8.36.0. Check the vendor advisory for mitigations.

References

https://www.atredis.com/disclosure

Get alerted when CVE-2026-1814 or the next vulnerability affects your stack